poe-code 15.0.0 → 15.0.2

package/packages/safe-js/dist/browser/chunks/{chunk-QK4IEGRO.js → chunk-CRKYNANF.js}

@@ -4034,13 +4034,33 @@ function composeAbortSignals(signals) {
   return { signal: controller.signal, dispose };
 }
 
-// packages/safe-fs/src/fs/webdav/xml.ts
-var XmlResponseLimitError = class extends SyntaxError {
+// packages/safe-fs/src/xml.ts
+var XmlLimitError = class extends SyntaxError {
+  constructor(limit, message) {
+    super(message);
+    this.limit = limit;
+  }
+  limit;
 };
+function* find(source, needle, start) {
+  let work = 0;
+  for (let offset = start; offset < source.length; offset++) {
+    if (source.startsWith(needle, offset)) {
+      if (work) yield work;
+      return offset;
+    }
+    if (++work === 512) {
+      yield work;
+      work = 0;
+    }
+  }
+  if (work) yield work;
+  return -1;
+}
 var xmlNamespace = "http://www.w3.org/XML/1998/namespace";
 var xmlnsNamespace = "http://www.w3.org/2000/xmlns/";
 function invalid(message) {
-  throw new SyntaxError(`Invalid WebDAV XML: ${message}`);
+  throw new SyntaxError(`Invalid XML: ${message}`);
 }
 function validCharacter(point) {
   return point === 9 || point === 10 || point === 13 || point >= 32 && point <= 55295 || point >= 57344 && point <= 65533 || point >= 65536 && point <= 1114111;
@@ -4051,22 +4071,42 @@ function nameStart(point) {
 function namePart(point) {
   return nameStart(point) || point === 45 || point === 46 || point === 183 || point >= 48 && point <= 57 || point >= 768 && point <= 879 || point >= 8255 && point <= 8256;
 }
-function qualifiedName(name) {
-  const parts = name.split(":");
-  if (parts.length > 2 || parts.some((part) => {
-    const points = [...part].map((character) => character.codePointAt(0));
-    return points.length === 0 || !nameStart(points[0]) || points.slice(1).some((point) => !namePart(point));
-  })) invalid("invalid qualified name");
-  return parts.length === 1 ? ["", parts[0]] : [parts[0], parts[1]];
+function* qualifiedName(name) {
+  let prefix = "";
+  let start = 0;
+  let first = true;
+  let work = 0;
+  for (let offset = 0; offset < name.length; ) {
+    const point = name.codePointAt(offset);
+    if (point === 58) {
+      if (start !== 0 || first) invalid("invalid qualified name");
+      prefix = name.slice(0, offset);
+      start = offset + 1;
+      first = true;
+    } else {
+      if (!(first ? nameStart(point) : namePart(point))) invalid("invalid qualified name");
+      first = false;
+    }
+    const width = point > 65535 ? 2 : 1;
+    offset += width;
+    work += width;
+    if (work >= 512) {
+      yield work;
+      work = 0;
+    }
+  }
+  if (first) invalid("invalid qualified name");
+  if (work) yield work;
+  return [prefix, name.slice(start)];
 }
-function entities(text) {
+function* entities(text) {
   let result = "";
   let offset = 0;
   while (offset < text.length) {
-    const start = text.indexOf("&", offset);
+    const start = yield* find(text, "&", offset);
     if (start < 0) return result + text.slice(offset);
     result += text.slice(offset, start);
-    const end = text.indexOf(";", start + 1);
+    const end = yield* find(text, ";", start + 1);
     if (end < 0) invalid("unterminated entity");
     const entity = text.slice(start + 1, end);
     const predefined = { amp: "&", lt: "<", gt: ">", quot: '"', apos: "'" };
@@ -4074,10 +4114,17 @@ function entities(text) {
     else {
       const hexadecimal = entity.startsWith("#x");
       const digits = entity.slice(hexadecimal ? 2 : 1);
-      if (!entity.startsWith("#") || !(hexadecimal ? /^[0-9a-fA-F]+$/ : /^[0-9]+$/).test(digits)) {
-        invalid("undeclared entity");
+      if (!entity.startsWith("#") || !digits.length) invalid("undeclared entity");
+      let point = 0;
+      for (let index = 0; index < digits.length; index++) {
+        const code = digits.charCodeAt(index);
+        const digit = code >= 48 && code <= 57 ? code - 48 : hexadecimal && code >= 65 && code <= 70 ? code - 55 : hexadecimal && code >= 97 && code <= 102 ? code - 87 : -1;
+        if (digit < 0) invalid("undeclared entity");
+        point = point * (hexadecimal ? 16 : 10) + digit;
+        if (point > 1114111) invalid("invalid character reference");
+        if ((index + 1) % 512 === 0) yield 512;
       }
-      const point = Number.parseInt(digits, hexadecimal ? 16 : 10);
+      if (digits.length % 512) yield digits.length % 512;
       if (!validCharacter(point)) invalid("invalid character reference");
       result += String.fromCodePoint(point);
     }
@@ -4085,149 +4132,336 @@ function entities(text) {
   }
   return result;
 }
-function parseXml(input, limits = {}) {
+function* validDeclaration(content, expectedEncoding) {
+  let offset = 0;
+  const whitespace = function* () {
+    const start = offset;
+    while (offset < content.length && " 	\n\r".includes(content[offset])) {
+      offset++;
+      if ((offset - start) % 512 === 0) yield 512;
+    }
+    if ((offset - start) % 512) yield (offset - start) % 512;
+    return offset - start;
+  };
+  const field = function* (name) {
+    if (content.slice(offset, offset + name.length).toLowerCase() !== name) return void 0;
+    offset += name.length;
+    yield name.length;
+    yield* whitespace();
+    if (content[offset++] !== "=") return void 0;
+    yield* whitespace();
+    const quote = content[offset++];
+    if (quote !== "'" && quote !== '"') return void 0;
+    const start = offset;
+    while (offset < content.length && content[offset] !== quote) {
+      offset++;
+      if ((offset - start) % 512 === 0) yield 512;
+    }
+    if ((offset - start) % 512) yield (offset - start) % 512;
+    if (offset >= content.length) return void 0;
+    return content.slice(start, offset++);
+  };
+  if (!(yield* whitespace()) || (yield* field("version")) !== "1.0") return false;
+  let spacing = yield* whitespace();
+  if (content.slice(offset, offset + 8).toLowerCase() === "encoding") {
+    if (!spacing) return false;
+    const encoding = yield* field("encoding");
+    if (encoding === void 0 || encoding.length > 8 || !["utf-8", "utf-16", "utf-16le", "utf-16be"].includes(encoding.toLowerCase())) return false;
+    if (expectedEncoding !== void 0 && encoding.toLowerCase() !== expectedEncoding.toLowerCase()) return false;
+    spacing = yield* whitespace();
+  }
+  if (content.slice(offset, offset + 10).toLowerCase() === "standalone") {
+    if (!spacing) return false;
+    const standalone = yield* field("standalone");
+    if (standalone === void 0 || standalone.length > 3 || !["yes", "no"].includes(standalone.toLowerCase())) return false;
+    yield* whitespace();
+  }
+  return offset === content.length;
+}
+function* parseXmlSteps(input, limits = {}) {
   const maxDepth = limits.maxDepth ?? 64;
   const maxNodes = limits.maxNodes ?? 1e5;
   const maxAttributes = limits.maxAttributes ?? 1e4;
-  for (const limit of [maxDepth, maxNodes, maxAttributes, ...limits.maxResponses === void 0 ? [] : [limits.maxResponses]]) {
+  const retainContent = limits.retainContent !== false;
+  const maxContentNodes = limits.maxContentNodes ?? (retainContent ? 1e5 : maxNodes);
+  const emptyContent = Object.freeze([]);
+  const emptyAttributes = Object.freeze([]);
+  const emptyNamespaces = /* @__PURE__ */ new Map();
+  const maxAttributesPerElement = limits.maxAttributesPerElement ?? 128;
+  const maxNamespaces = limits.maxNamespaces ?? 256;
+  for (const limit of [maxDepth, maxNodes, maxAttributes, maxContentNodes, maxAttributesPerElement, maxNamespaces]) {
     if (!Number.isSafeInteger(limit) || limit < 1) throw new RangeError("XML limits must be positive integers");
   }
-  for (const character of input) {
-    if (!validCharacter(character.codePointAt(0))) invalid("invalid character");
+  const chunks = [];
+  let chunk = "";
+  for (let index = input.charCodeAt(0) === 65279 ? 1 : 0; index < input.length; index++) {
+    const point = input.codePointAt(index);
+    if (!validCharacter(point)) invalid("invalid character");
+    if (point === 13) {
+      chunk += "\n";
+      if (input.charCodeAt(index + 1) === 10) index++;
+    } else {
+      chunk += String.fromCodePoint(point);
+      if (point > 65535) index++;
+    }
+    if (chunk.length >= 512) {
+      chunks.push(chunk);
+      chunk = "";
+      yield 512;
+    }
   }
-  const source = input.replace(/^\uFEFF/, "").replace(/\r\n?/g, "\n");
+  chunks.push(chunk);
+  if (chunk.length) yield chunk.length;
+  const source = chunks.join("");
   const stack = [];
   let root;
+  let declaration;
   let offset = 0;
   let nodes = 0;
   let attributeCount = 0;
-  let responses2 = 0;
-  const whitespace = () => {
-    while (offset < source.length && " 	\n\r".includes(source[offset])) offset++;
+  let contentNodes = 0;
+  const admitContent = () => {
+    if (++contentNodes > maxContentNodes) throw new XmlLimitError("maxContentNodes", "XML content node limit exceeded");
+  };
+  const whitespace = function* () {
+    let work = 0;
+    while (offset < source.length && " 	\n\r".includes(source[offset])) {
+      offset++;
+      if (++work === 512) {
+        yield work;
+        work = 0;
+      }
+    }
+    if (work) yield work;
   };
-  const readName = () => {
+  const readName = function* () {
     const start = offset;
-    while (offset < source.length && !" 	\r\n/=>?".includes(source[offset])) offset++;
+    while (offset < source.length && !" 	\r\n/=>?".includes(source[offset])) {
+      offset++;
+      if ((offset - start) % 512 === 0) yield 512;
+    }
+    if ((offset - start) % 512) yield (offset - start) % 512;
     const name = source.slice(start, offset);
-    qualifiedName(name);
+    yield* qualifiedName(name);
     return name;
   };
-  const appendText = (text) => {
+  const appendText = function* (text, kind = "text") {
     const parent = stack.at(-1);
-    if (parent) parent.element.text += text;
-    else if (!/^[ \t\r\n]*$/.test(text)) invalid("text outside the root");
+    if (parent) {
+      parent.element.text += text;
+      if (retainContent && (text.length || kind === "cdata")) {
+        admitContent();
+        parent.content.push({ kind, text });
+      }
+    } else {
+      for (let index = 0; index < text.length; index++) {
+        if (!" 	\r\n".includes(text[index])) invalid("text outside the root");
+        if ((index + 1) % 512 === 0) yield 512;
+      }
+      if (text.length % 512) yield text.length % 512;
+    }
   };
   while (offset < source.length) {
+    yield 1;
     if (source[offset] !== "<") {
-      const next = source.indexOf("<", offset);
+      const next = yield* find(source, "<", offset);
       const text = source.slice(offset, next < 0 ? source.length : next);
-      if (text.includes("]]>")) invalid("CDATA terminator in text");
-      appendText(entities(text));
+      if ((yield* find(text, "]]>", 0)) >= 0) invalid("CDATA terminator in text");
+      yield* appendText(yield* entities(text));
       offset += text.length;
     } else if (source.startsWith("<!--", offset)) {
-      const end = source.indexOf("-->", offset + 4);
-      if (end < 0 || source.slice(offset + 4, end).includes("--") || source.slice(offset + 4, end).endsWith("-")) {
+      const end = yield* find(source, "-->", offset + 4);
+      if (end < 0 || (yield* find(source.slice(offset + 4, end), "--", 0)) >= 0 || source.slice(offset + 4, end).endsWith("-")) {
         invalid("malformed comment");
       }
+      const parent = stack.at(-1);
+      if (retainContent && parent) {
+        admitContent();
+        parent.content.push({ kind: "comment", text: source.slice(offset + 4, end) });
+      }
       offset = end + 3;
     } else if (source.startsWith("<![CDATA[", offset)) {
       if (!stack.length) invalid("CDATA outside root");
-      const end = source.indexOf("]]>", offset + 9);
+      const end = yield* find(source, "]]>", offset + 9);
       if (end < 0) invalid("unterminated CDATA");
-      appendText(source.slice(offset + 9, end));
+      yield* appendText(source.slice(offset + 9, end), "cdata");
       offset = end + 3;
     } else if (source.startsWith("<?", offset)) {
       const start = offset;
       offset += 2;
-      const target = readName();
-      const end = source.indexOf("?>", offset);
+      const target = yield* readName();
+      const end = yield* find(source, "?>", offset);
       if (end < 0) invalid("unterminated processing instruction");
       const content = source.slice(offset, end);
-      if (target.toLowerCase() === "xml") {
-        if (start !== 0 || target !== "xml" || !/^\s+version\s*=\s*(['"])1\.0\1(?:\s+encoding\s*=\s*(['"])(?:UTF-8|UTF-16|UTF-16LE|UTF-16BE)\2)?(?:\s+standalone\s*=\s*(['"])(?:yes|no)\3)?\s*$/i.test(content)) {
+      if (target.length === 3 && target.toLowerCase() === "xml") {
+        if (start !== 0 || target !== "xml" || !(yield* validDeclaration(content, limits.expectedEncoding))) {
           invalid("unsupported XML declaration");
         }
+        if (retainContent) declaration = source.slice(start, end + 2);
       } else if (content && !" 	\n\r".includes(content[0])) invalid("invalid processing instruction");
+      if (!(target.length === 3 && target.toLowerCase() === "xml")) {
+        const parent = stack.at(-1);
+        if (retainContent && parent) {
+          let start2 = 0;
+          while (start2 < content.length && " 	\n\r".includes(content[start2])) {
+            start2++;
+            if (start2 % 512 === 0) yield 512;
+          }
+          if (start2 % 512) yield start2 % 512;
+          admitContent();
+          parent.content.push({ kind: "processing-instruction", target, text: content.slice(start2) });
+        }
+      }
       offset = end + 2;
     } else if (source.startsWith("<!", offset)) {
       invalid("DTD and entity declarations are forbidden");
     } else if (source.startsWith("</", offset)) {
       offset += 2;
-      const name = readName();
-      whitespace();
+      const name = yield* readName();
+      yield* whitespace();
       if (source[offset++] !== ">" || stack.pop()?.name !== name) invalid("mismatched closing tag");
     } else {
       offset++;
-      const name = readName();
+      const name = yield* readName();
       const attributes = /* @__PURE__ */ new Map();
-      const namespaces = new Map(stack.at(-1)?.namespaces ?? [["xml", xmlNamespace]]);
+      let namespaces = stack.at(-1)?.namespaces ?? /* @__PURE__ */ new Map([["xml", xmlNamespace]]);
+      let ownsNamespaces = stack.length === 0;
       while (true) {
         const beforeSpace = offset;
-        whitespace();
+        yield* whitespace();
         if (source[offset] === "/" || source[offset] === ">") break;
         if (offset === beforeSpace) invalid("attributes require whitespace");
-        const attribute = readName();
+        const attribute = yield* readName();
         if (attributes.has(attribute)) invalid("duplicate attribute");
-        if (++attributeCount > maxAttributes || attributes.size >= 128) invalid("XML attribute limit exceeded");
-        whitespace();
+        if (++attributeCount > maxAttributes) throw new XmlLimitError("maxAttributes", "XML attribute limit exceeded");
+        if (attributes.size >= maxAttributesPerElement) throw new XmlLimitError("maxAttributesPerElement", "XML attribute limit exceeded");
+        yield* whitespace();
         if (source[offset++] !== "=") invalid("missing attribute equals");
-        whitespace();
+        yield* whitespace();
         const quote = source[offset++];
         if (quote !== '"' && quote !== "'") invalid("unquoted attribute");
-        const end = source.indexOf(quote, offset);
+        const end = yield* find(source, quote, offset);
         if (end < 0) invalid("unterminated attribute");
         const raw = source.slice(offset, end);
-        if (raw.includes("<")) invalid("less-than in attribute");
-        const value = entities(raw.replace(/[\t\n\r]/g, " "));
+        if ((yield* find(raw, "<", 0)) >= 0) invalid("less-than in attribute");
+        let normalized = "";
+        for (let index = 0; index < raw.length; index++) {
+          const character = raw[index];
+          normalized += character === "	" || character === "\n" || character === "\r" ? " " : character;
+          if ((index + 1) % 512 === 0) yield 512;
+        }
+        if (raw.length % 512) yield raw.length % 512;
+        const value = yield* entities(normalized);
         attributes.set(attribute, value);
         offset = end + 1;
         if (attribute === "xmlns" || attribute.startsWith("xmlns:")) {
           const prefix2 = attribute === "xmlns" ? "" : attribute.slice(6);
           if (prefix2 === "xmlns" || value === xmlnsNamespace || prefix2 === "xml" !== (value === xmlNamespace) || prefix2 !== "" && value === "") invalid("invalid namespace binding");
+          if (!ownsNamespaces) {
+            const copy = /* @__PURE__ */ new Map();
+            for (const [key, uri] of namespaces) {
+              copy.set(key, uri);
+              yield 1;
+            }
+            namespaces = copy;
+            ownsNamespaces = true;
+          }
           namespaces.set(prefix2, value);
-          if (namespaces.size > 256) invalid("XML namespace scope limit exceeded");
+          if (namespaces.size > maxNamespaces) throw new XmlLimitError("maxNamespaces", "XML namespace scope limit exceeded");
         }
       }
       const expanded = /* @__PURE__ */ new Set();
       for (const attribute of attributes.keys()) {
         if (attribute === "xmlns" || attribute.startsWith("xmlns:")) continue;
-        const [prefix2, localName2] = qualifiedName(attribute);
+        const [prefix2, localName2] = yield* qualifiedName(attribute);
         if (prefix2 && !namespaces.has(prefix2)) invalid("unbound attribute prefix");
         const key = JSON.stringify([prefix2 ? namespaces.get(prefix2) : "", localName2]);
         if (expanded.has(key)) invalid("duplicate expanded attribute");
         expanded.add(key);
       }
-      const [prefix, localName] = qualifiedName(name);
+      const [prefix, localName] = yield* qualifiedName(name);
       if (prefix === "xmlns" || prefix && !namespaces.has(prefix)) invalid("unbound element prefix");
-      if (++nodes > maxNodes || stack.length + 1 > maxDepth) invalid("XML resource limit exceeded");
+      if (++nodes > maxNodes) throw new XmlLimitError("maxNodes", "XML resource limit exceeded");
+      if (stack.length + 1 > maxDepth) throw new XmlLimitError("maxDepth", "XML resource limit exceeded");
       const namespace = namespaces.get(prefix) ?? "";
-      if (limits.maxResponses !== void 0 && stack.length === 1 && root?.namespace === "DAV:" && root.localName === "multistatus" && namespace === "DAV:" && localName === "response" && ++responses2 > limits.maxResponses) {
-        throw new XmlResponseLimitError("WebDAV XML response limit exceeded");
+      limits.onElement?.({ name, namespace, localName }, stack.at(-1)?.element, stack.length + 1);
+      admitContent();
+      const retainedAttributes = [];
+      for (const [attribute, value] of retainContent ? attributes : []) {
+        const [prefix2, localName2] = yield* qualifiedName(attribute);
+        admitContent();
+        retainedAttributes.push({
+          name: attribute,
+          localName: localName2,
+          namespace: attribute === "xmlns" || prefix2 === "xmlns" ? xmlnsNamespace : prefix2 ? namespaces.get(prefix2) : "",
+          value
+        });
+        yield 1;
       }
-      const element = { namespace, localName, children: [], text: "" };
+      const content = retainContent ? [] : void 0;
+      const element = { kind: "element", name, namespace, localName, children: [], text: "", content: content ?? emptyContent, attributes: retainContent ? retainedAttributes : emptyAttributes, namespaces: retainContent ? namespaces : emptyNamespaces, ...root === void 0 && declaration !== void 0 ? { declaration } : {} };
       const parent = stack.at(-1);
-      if (parent) parent.element.children.push(element);
-      else if (root) invalid("multiple root elements");
+      if (parent) {
+        parent.element.children.push(element);
+        parent.content?.push(element);
+      } else if (root) invalid("multiple root elements");
       else root = element;
       const empty = source[offset] === "/";
       if (empty) offset++;
       if (source[offset++] !== ">") invalid("unterminated start tag");
-      if (!empty) stack.push({ element, name, namespaces });
+      if (!empty) stack.push({ element, content, name, namespaces });
     }
   }
   if (stack.length || !root) invalid("incomplete document");
   return root;
 }
+function parseXml(input, limits = {}) {
+  const parser = parseXmlSteps(input, limits);
+  let result = parser.next();
+  while (!result.done) result = parser.next();
+  return result.value;
+}
+
+// packages/safe-fs/src/fs/webdav/xml.ts
+var XmlResponseLimitError = class extends SyntaxError {
+};
+function invalid2(message) {
+  throw new SyntaxError(`Invalid WebDAV XML: ${message}`);
+}
+function parseXml2(input, limits = {}) {
+  const { maxResponses, ...documentLimits } = limits;
+  if (maxResponses !== void 0 && (!Number.isSafeInteger(maxResponses) || maxResponses < 1)) {
+    throw new RangeError("XML limits must be positive integers");
+  }
+  let responses2 = 0;
+  try {
+    return parseXml(input, {
+      ...documentLimits,
+      retainContent: false,
+      onElement(element, parent, depth) {
+        if (maxResponses !== void 0 && depth === 2 && parent?.namespace === "DAV:" && parent.localName === "multistatus" && element.namespace === "DAV:" && element.localName === "response" && ++responses2 > maxResponses) {
+          throw new XmlResponseLimitError("WebDAV XML response limit exceeded");
+        }
+      }
+    });
+  } catch (error) {
+    if (error instanceof XmlLimitError) invalid2(error.message);
+    if (error instanceof SyntaxError && error.message.startsWith("Invalid XML:")) {
+      error.message = error.message.replace("Invalid XML:", "Invalid WebDAV XML:");
+    }
+    throw error;
+  }
+}
 function davChildren(element, localName) {
   return element.children.filter((child) => child.namespace === "DAV:" && child.localName === localName);
 }
 function davChild(element, localName) {
   const children = davChildren(element, localName);
-  if (children.length > 1) invalid(`duplicate DAV:${localName}`);
+  if (children.length > 1) invalid2(`duplicate DAV:${localName}`);
   return children[0];
 }
 function scalar(element) {
-  if (element.children.length) invalid("expected text-only element");
+  if (element.children.length) invalid2("expected text-only element");
   return element.text.trim();
 }
 
@@ -4711,7 +4945,7 @@ var WebDavFileSystem = class {
   async xml(response, signal, maxResponses) {
     const data = await this.bytes(response, this.maxXmlBytes, signal);
     const encoding = data[0] === 255 && data[1] === 254 || data[0] === 60 && data[1] === 0 ? "utf-16le" : data[0] === 254 && data[1] === 255 || data[0] === 0 && data[1] === 60 ? "utf-16be" : "utf-8";
-    return parseXml(new TextDecoder(encoding, { fatal: true }).decode(data), maxResponses === void 0 ? void 0 : { maxResponses });
+    return parseXml2(new TextDecoder(encoding, { fatal: true }).decode(data), maxResponses === void 0 ? void 0 : { maxResponses });
   }
   async multistatus(response, signal, method = "PROPFIND", path = "") {
     const link = response.headers.get("link");
@@ -6037,7 +6271,10 @@ export {
   FileSystemQuotaError,
   withFileSystemQuota,
   scopeFileSystem,
+  XmlLimitError,
+  parseXmlSteps,
+  parseXml,
   WebDavFileSystem,
   createFsBridge
 };
-//# sourceMappingURL=chunk-QK4IEGRO.js.map
+//# sourceMappingURL=chunk-CRKYNANF.js.map